Introduction

Environment

Steps

1. Log in to https://portal.azure.com

1. Click More services

1. Scroll down and click App registrations
   
   

1. Click New application registration
   
   

1. Type in a Name. Application type must be Web app/API.
   
   Sign-on URL is the entry point to CA11
   https://IACSSUK16SRV2.CASUPPORT.SUPPORT2016.AD.HURSLEY.IBM.COM:9309/bi/v1/disp

1. Click Create

1. Edit the Application by selecting Settings
   
   

1. Click Reply URLs to add the Redirect URL
   

1. Add the Return URL
   

1. Click Save

1. Then generate the Client Secret by clicking Keys
   
   

1. Type in a description
   

1. Click Save and store the value somewhere as it’s a once only opportunity to capture it.
   

1. Next find the Tenant ID that will be required to update the Discovery Endpoint
   
   Open the downloaded PortalDiagnostics.json file and locate the “tenants” element"tenants": [
   {
   "id": "6b3ec521-c99e-4cc2-bd63-e79e654151da",
   "domainName": "AZURECOGNOSLAB.onmicrosoft.com",
   "displayName": "COGNOSLAB",
   "isSignedInTenant": true
   }

1. Summary of all the required information to configure the OpenID Connect Namespace for Azure are:Tenant ID - 6b3ec521-c99e-4cc2-bd63-e79e654151da
   Client ID - acd096fc-e0f8-4740-8267-18a947aa809e
   
   Client Secret - WgYNsqAZfBa1DGtdEJRgAw9ap79WGKgs1BG9lnTaEH8=
   Return URL https://IACSSUK16SRV2.CASUPPORT.SUPPORT2016.AD.HURSLEY.IBM.COM:9309/bi/completeAuth.jspNext, transfer the above configuration information into a new Azure OIDC Namespace

1. Create a new Namespace
   

1. Transfer the details as outlined in point 15 above
   Discovery Endpoint is:
   https://login.microsoftonline.com:443/{tenantid}/.well-known/openid-configurationReplace the ‘{tenanted}’ with the alpha-numeric captured from Step 14https://login.microsoftonline.com:443/6b3ec521-c99e-4cc2-bd63-e79e654151da/.well-known/openid-configurationPopulate the Client ID, OpenID Connect client secret value and Return URLSo, now the configuration looks like this:NB: Make sure all URIs are switched from HTTP to HTTPS

1. Save the configuration and exit but do not start.

1. Download the certificate (issuer)
   With your web browser access the discovery endpoint  and download the issuer certificate:
   https://login.microsoftonline.com:443/6b3ec521-c99e-4cc2-bd63-e79e654151da/.well-known/openid-configuration
   
   
   
   

1. Save the certificate (*.crt) in the CA installation /bin64 directory

1. Open a command window and navigate to the /bin directory and execute the following command:
   ThirdPartyCertificateTool.bat -i -T -r stamp2loginmicrosoftonlinecom.crt -p NoPassWordSet

1. Open Cognos Configuration and start the service.

1. Open CA11 URL and select the AzureAD namespace

1. Log in using the AzureAD user login.
   
   

Troubleshooting